Security and privacy
Your financial data deserves careful protection. This page sets out the measures the application actually applies and which external services may process data.
At a glance
- Data storage: the application database and document storage run in a Supabase region in London (eu-west-2); AI processing may take place outside the UK.
- Encryption: encrypted transport (TLS) and encrypted storage provided by the infrastructure.
- Data isolation: strict separation per workspace at database level (row-level security).
- AI training: Anthropic does not use API inputs and outputs for model training by default.
- Deletion: on request, subject to legal and technical retention periods.
Certifications mentioned are those of the providers: a SOC 2 Type II report from Supabase and ISO/IEC 27001 for the AWS data centres.
What this page covers
Where data is stored, how it is encrypted and kept apart from other customers, who has access (the roles Admin, Preparer, Reviewer, Approver and Client), how data is protected in AI processing, what happens at the end of the contract, which sub-processors may process data, and your rights under the UK GDPR.
StatutoryAccounts.io is not a long-term archive: you export the records you must keep. To report a vulnerability, see Report a vulnerability.